Unable to get Logstash Centralised Management working

This morning i tried to move an existing logstash to use Centralised Management.

I configured the logstash yml as per documentation.

xpack.management.enabled: true
xpack.management.pipeline.id: ["{pipeline-id}"]
xpack.management.elasticsearch.username: "{username}"
xpack.management.elasticsearch.password: "{password}"
xpack.management.elasticsearch.hosts: ["{elastic host}"]

I used the details directly from the existing pipelines output: username, password, elastic hosts.

I confirmed {username} has:
logstash_admin
logstash_writer

as per:
https://www.elastic.co/guide/en/logstash/7.x/logstash-centralized-pipeline-management.html

On restarting - I saw these errors in the logs (Note; I've replaced our host with {host}):

Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [https://{host}/][Manticore::ClientProtocolException] {host} failed to respond"}

Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.

In case this was a red herring - I configured pipelines in Kibana using the pipeline.id from logstash.yml config. i.e. {pipeline-id} above.
and copied the existing file based config input, filter, and output for this this pipeline, into Kibana.

No data arrived in Elastic. And same error is written to logstash logs...

I read on another post that there was a bug in logstash 7.6.0 with same error, so I updated logstash to 7.9.0

Still the same error is logged.

In the logs it reports that it is starting the pipeline and it is using: central pipeline management:

"pipeline.sources"=>["central pipeline management"

And the pipeline starts...

I have also tried using a super user account.

I have reverted the changes to logstash yml, and now data is appearing - as per the pipeline.yml, but going forwards, we would like to use this feature.

Any help diagnosing appreciated.

Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.